Triage Cloud Cost Spike

Files (1)

• SKILL.md

SKILL.md (first lines)

## When to use

Use when daily cost increases significantly versus baseline.

## Preconditions

- You can access billing/cost breakdown and recent change/deploy history.

## Procedure

1. Confirm the spike magnitude and when it started.
2. Break down by service, region, and top resources/tags.
3. Identify the change driver: deploy, scaling, traffic, misconfiguration, abuse.
4. Validate whether spend is expected (planned test) or unexpected.
5. Choose the safest mitigation: pause non-critical workloads, cap scaling, fix loops.

## Decision points

- Compute spike: check autoscaling, instance sizes, and runaway jobs.
- Network spike: check egress, NAT, CDN settings, cross-region traffic.
- Storage spike: check log retention, snapshots, object lifecycle policies.

## Verification

- Cost trend returns toward baseline within the next billing window.
- The change driver is addressed (scaling capped, job stopped, retention fixed).

## Rollback / undo

- Revert cost mitigation that impacts critical reliability.
- Restore paused workloads in a controlled manner.

## Escalation

- FinOps/cloud owners for billing anomalies or reserved commitment adjustments.
- Security team if spike may be caused by abuse/compromise.

## Examples

```text
Start with a service-by-service cost breakdown, then drill into the top 1-3 line items.
```

From bregman-arie/devops-sre-skills, Apache-2.0.

More from bregman-arie/devops-sre-skills